A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe
I think Binance needs to start having IT Security like a bank as well.
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish that my doctors and lawyers have passed some tests.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
I think Binance needs to start having IT Security like a bank as well.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
And now you get results like this.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
They did, in their sentence "the incident report said".
It's one of the reason ojcp exists.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
I do not buy it.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.